It is recommended that you enforce a security mode 3 at the least.

Using a long passcode prevents the correct link key from being easily computed. Do not perform pairing at public places to prevent an attacker from eavesdropping during the pairing occasion and recording all communications between devices. An attacker can also obtain the passcode and link key by initiating a key exchange with a victim device.

Because Bluetooth supports device-based authentication, it is possible that a peer device may request a service that exposes sensitive data. To avoid this, ensure that you pair with privileged devices. Restricting access to privileged devices provides security. Privileged devices are devices that have fixed, or paired, relationships and that have access to services.

The user should be aware that during the pairing procedure, the initial exchange of keys is the weakest part of the security procedure because non-encrypted channels are used. To minimize the risk of eavesdropping during the communication, make sure that the surrounding environment is clear of potential intruders when the pairing process is in progress.

Put your device into a connection mode that uses a key derived during bonding for only one session and then delete it.

Disconnect the devices after the transaction is complete. Use a different passcode for the pairing process each time. It is possible to launch an attack by continuously attempting to connect to a Bluetooth device. Therefore, enable discoverable mode only when required.

Allow only privileged devices and services to use the Bluetooth PAN service